Kelly Kaoudis

An Input Validation issue exists due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets.

The issue is related to the improper handling of extraneous zero characters at the beginning of an IP address string in the library/std/src/net/parser.rs file. This can allow attackers to bypass access control based on IP addresses due to unexpected octal interpretation, potentially leading to data integrity violations and denial of service.

The issue is related to improper authorization in the Data::Validate::IP module. It allows a remote attacker to impact data integrity by bypassing access control based on IP addresses. This is due to the module not properly considering extraneous zero characters at the beginning of an IP address string.

Name of the Vulnerable Software and Affected Versions: netmask npm package versions 1.0.6 and below netmask npm package versions 2.0.0 Description: The issue is related to improper input validation of octal strings in the netmask npm package, allowing unauthenticated remote attackers to perform server-side request forgery (SSRF), remote file inclusion (RFI), and local file inclusion (LFI) attacks. This vulnerability can be exploited to bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts. The netmask package is used by over 270,000 projects and has around 3 million downloads per week. Recommendations: For netmask npm package versions 1.0.6 and below: Upgrade to version 2.0.1 or later to ensure complete protection from this vulnerability. For netmask npm package version 2.0.0: Upgrade to version 2.0.1 or later, as the initial fix in version 2.0.0 was incomplete.